Encrypting replication journals in a storage system

Abstract

Described embodiments provide systems and methods for encrypting journal data of a storage system. At least one key is generated, each key having an associated key identifier. The at least one key and the associated key identifiers are stored to a key store. User data is read from a replica volume of the storage system. The read user data is encrypted with an associated key. Encrypted data is written to a journal associated with the replica volume. The key identifier of the associated key is written to the journal.

We claim: 
     
       1. A method of encrypting journal data of a storage system, the method comprising:
 generating keys, each of the keys having an associated key identifier; 
 storing the keys and the associated key identifiers to a key store; 
 reading user data from a replica volume of the storage system; 
 encrypting the read user data with one of the keys; 
 writing encrypted user data to a journal associated with the replica volume; 
 writing the key identifier of the key used to the encrypted user data to the journal; 
 determining, from encrypted journal data of the journal, the key identifier of the key corresponding to the encrypted user data; 
 decrypting the encrypted journal data with the key from the key store, the retrieved key corresponding to the key identifier; 
 writing the decrypted journal data to a roll back replica; 
 rolling back a production volume to an earlier point in time based upon the roll back replica; and 
 writing decrypted journal data to a metadata stream associated with the roll back replica and rolling back the production volume based upon the metadata stream. 
 
     
     
       2. The method of  claim 1 , wherein generating the keys comprises generating, periodically based on a key expiration period, at least one new key to replace at least one expired key. 
     
     
       3. The method of  claim 1 , further comprising:
 setting, based upon a protection window of the storage system, journal data as expired; and 
 determining a key identifier associated with the expired journal data; and 
 permanently deleting the key associated with the determined key identifier. 
 
     
     
       4. The method of  claim 3 , further comprising:
 periodically performing a garbage collection operation to delete journal data associated with deleted keys. 
 
     
     
       5. The method of  claim 4 , wherein the garbage collection operation is performed as a background operation during idle time of the storage system, and wherein the key expiration period is set based upon the protection window. 
     
     
       6. A system comprising:
 a processor; and 
 memory storing computer program code that when executed on the processor causes the processor to operate a storage system, the storage system operable to encrypting journal data by performing the operations of:
 generating keys, each of the keys having an associated key identifier; 
 storing the keys and the associated key identifiers to a key store; 
 reading user data from a replica volume of the storage system; 
 encrypting the read user data with one of the keys; 
 writing encrypted user data to a journal associated with the replica volume; 
 writing the key identifier of the key used to encrypt the user data to the journal; 
 determining, from encrypted journal data of the journal, the key identifier of the key corresponding to the encrypted user data; 
 decrypting the journal data with a key retrieved from the key store; 
 writing the decrypted journal data to a roll back replica; 
 rolling back the production volume to an earlier point in time based upon the roll back replica; and 
 writing decrypted journal data to a metadata stream associated with the roll back replica and rolling back the production volume based upon the metadata stream. 
 
 
     
     
       7. The system of  claim 6 , wherein the storage system is further operable to perform the operation of generating, periodically based on a key expiration period, at least one new key to replace at least one expired key. 
     
     
       8. The system of  claim 6 , wherein the storage system is further operable to perform the operations of:
 setting, based upon a protection window of the storage system, journal data as expired; and 
 determining a key identifier associated with the expired journal data; and 
 permanently deleting the key associated with the determined key identifier. 
 
     
     
       9. The system of  claim 8 , wherein the storage system is further operable to perform the operation of:
 periodically performing a garbage collection operation to delete journal data associated with deleted keys, 
 wherein the garbage collection operation is performed as a background operation during idle time of the storage system, and wherein the key expiration period is set based upon the protection window. 
 
     
     
       10. A computer program product including a non-transitory computer readable storage medium having computer program code encoded thereon that when executed on a processor of a computer causes the computer to operate a storage system, the computer program product comprising:
 computer program code for performing operations, comprising: 
 generating keys, each of the keys having an associated key identifier; 
 storing the keys and the associated key identifiers to a key store; 
 reading user data from a replica volume of the storage system; 
 encrypting the read user data with one of the keys; 
 writing encrypted user data to a journal associated with the replica volume; 
 writing the key identifier of the key used to encrypt the user data to the journal; and 
 rolling back a production volume of the storage system to an earlier point in time, comprising: 
 determining, from encrypted journal data of the journal, the key identifier of the key corresponding to the encrypted user data; 
 decrypting the journal data with the key from the key store, the retrieved key corresponding to the key identifier; 
 writing the decrypted journal data to a roll back replica; 
 rolling back the production volume to the earlier point in time based upon the roll back replica; and 
 writing decrypted journal data to a metadata stream associated with the roll back replica and rolling back the production volume based upon the metadata stream. 
 
     
     
       11. The computer program product of  claim 10 , further comprising computer program code for generating, periodically based on a key expiration period, at least one new key to replace at least one expired key. 
     
     
       12. The computer program product of  claim 10 , wherein the computer program code further performs operations comprising:
 setting, based upon a protection window of the storage system, journal data as expired; and 
 determining a key identifier associated with the expired journal data; and 
 permanently deleting the key associated with the determined key identifier. 
 
     
     
       13. The computer program product of  claim 12 , further comprising computer program code for periodically performing a garbage collection operation to delete journal data associated with deleted keys,
 wherein the garbage collection operation is performed as a background operation during idle time of the storage system, and wherein the key expiration period is set based upon the protection window.